Abstract: A method of authorizing a transaction may include receiving, by a hosted service from a client device, a request to access an account and determining whether a user of the client device is permitted to access the account. The method may include, in response to determining that the user is permitted to access the account, receiving, from the client device, a request to initiate a transaction, determining whether the transaction is a long-lived transaction, in response to determining that the transaction is a long-lived transaction, creating a transaction credential associated with the long-lived transaction, and determining, based at least in part on the transaction credential, whether the execution of the long-lived transaction is authorized.

Abstract: This document describes methods and systems by which a data storage service migrates a volume of stored data from an unencrypted format to an encrypted format while still permitting user access to the data. The encryption process uses migration markers to identify records that have undergone the encryption process. When migration is complete, the service removes the migration markers and retains the encrypted data in a data storage facility.

Abstract: Methods and systems for managing access to stored data resources assign one or more wrapped (encrypted) encryption keys to each data resource. The resources are encrypted, and the keys may be stored in an access control list (ACL) in association with the encrypted data resources. The keys may be wrapped with metadata that indicates who or what is authorized to use the resource and what role the user or users may have with respect to the resource. The keys may be unwrapped upon receipt of access requests from authorized users, and may be used to decrypt the data resources.

Abstract: A system and method for negotiating multi-path connections between a plurality of intermediary devices, such as boundary controllers, in a networked computing environment is described. A client-side communications session is established between a requesting client and an intermediary device available from a plurality of intermediary devices on a primary communications channel in accordance with a connection-oriented network protocol. A server-side communications session is established between the intermediary device and the requested server on a primary communications channel in accordance with the connection-oriented network protocol. Differences in routing parameters defined for the client-side communications session and the server-side communications session are determined. The routing parameter differences are communicated to at least one other such intermediary device over an out-of-band communications channel.

Abstract: A system and method for negotiating multi-path connections between a plurality of intermediary devices, such as boundary controllers, in a networked computing environment is described. A client-side communications session is established between a requesting client and an intermediary device available from a plurality of intermediary devices on a primary communications channel in accordance with a connection-oriented network protocol. A server-side communications session is established between the intermediary device and the requested server on a primary communications channel in accordance with the connection-oriented network protocol. Differences in routing parameters defined for the client-side communications session and the server-side communications session are determined. The routing parameter differences are communicated to at least one other such intermediary device over an out-of-band communications channel.

Abstract: A system and method for transacting a validated application session in a networked computing environment is described. A hierarchical protocol stack having a plurality of interfaced protocol layers is defined. A connection-based session protocol layer is included. A session is opened with a requesting client responsive to a request packet containing a source address of uncertain trustworthiness. A client connection with the requesting client is negotiated. A stateless validation of the source address contained in the request packet is performed using encoded information obtained from the request packet headers. A server connection is negotiated with a responding server upon successful validation of the requesting client. The session is facilitated by translating packets independently exchanged over the client connection and the server connection. The session is closed through a controlled termination of each of the client connection and the server connection.